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Abstract 

In this paper, we first propose a general interpolation algorithm in a free module of a linearized 
polynomial ring, and then apply this algorithm to decode several important families of codes, Gabidulin 
codes, KK codes and MV codes. Our decoding algorithm for Gabidulin codes is different from the 
polynomial reconstruction algorithm by Loidreau. When applied to decode KK codes, our interpolation 
algorithm is equivalent to the Sudan-style list- 1 decoding algorithm proposed by Kotter and Kschischang 
for KK codes. The general interpolation approach is also capable of solving the interpolation problem 
for the list decoding of MV codes proposed by Mahdavifar and Vardy, and has a lower complexity than 
solving linear equations. 

I. Introduction 

Given a set of points, polynomial interpolation finds one or more polynomials that go through these 
points. Since error correcting codes are often defined through polynomials, polynomial interpolation 
is instrumental in decoding such error control codes. For instance, Reed-Solomon (RS) codes can be 
defined using evaluation of polynomials fQ, and bivariate polynomial interpolation has been used in RS 
decoders. In particular, the Kotter interpolation |J2| implements the interpolation step of the Guruswami- 
Sudan algorithm [3] for RS codes with low complexity. Also, the Welch-Berlekamp key equation can 
be viewed as a rational interpolation problem, and the Welch-Berlekamp algorithm (WBA) solves this 
problem 0. 

Polynomial interpolation was extended by Wang et al. (5j to a general interpolation problem in a free 
module that is defined over a polynomial ring over some finite field F and admits an ordering. Since 
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the free module is also a vector space over F, one can define linear functional on the free module. 
Given any set of linear functionals, the general interpolation problem is to find a minimum element in 
the intersection of the kernels of the linear functionals. Wang et al. proposed a general interpolation 
algorithm, and showed that the Kotter interpolation and the WBA are both special cases of this general 
interpolation algorithm [|5]. 

Recently, error control codes defined using evaluation of linearized polynomials have attracted growing 
attention, such as Gabidulin codes @ and a family of subspace codes proposed by Kotter and Kschischang 
Q, referred to as KK codes. While both Gabidulin and KK codes are important to error control in random 
linear network coding (see, for example, |E]-||9]), Gabidulin codes are also considered for potential 
applications in wireless communications [fTOl . public -key cryptosystems iPTTt . and storage systems [fl], 
Ifi2ll . A decoding algorithm of Gabidulin codes through linearized polynomial reconstruction was proposed 
by Loidreau lfl3l . and Kotter and Kschischang proposed a Sudan-style list- 1 decoding algorithm for KK 
codes based on bivariate linearized polynomial interpolation 0. Following similar list decoding idea for 
RS codes by Guruswami and Sudan |3j, Mahdavifar and Vardy considered list decoding of KK codes 
in lfl4l lfT31 . where the construction of KK codes were modified accordingly. Codes in |[T4l ifTSj are 
similar to but different from KK codes, and we call the new class of subspaces codes MV codes. 

Parallel to the work of Wang et al. |3), we investigate the general interpolation problem in a free 
module of a linearized polynomial ring. The main contributions of this paper are listed as follows. 

• We propose a general interpolation algorithm in a free module of a linearized polynomial ring, and 
show that our interpolation algorithm has a polynomial time complexity. 

• We apply our interpolation algorithm to decode Gabidulin codes. The resulted decoding algorithm 
resembles Loidreau's decoding algorithm (cf. ITT31 Table 1]), and both algorithms have quadratic 
complexity, but the two differ in several key aspects. 

• Our general interpolation approach is also used to decode KK codes. In fact, in this case, our 
algorithm is equivalent to the Sudan-style list- 1 decoding algorithm in Q. That is, the Sudan- 
style list- 1 decoding algorithm is a special case of our general interpolation algorithm, when some 
operations and parameters are specified. 

• Finally, we use our general interpolation algorithm to obtain the multivariate polynomial for the list 
decoding of MV codes in lfl4l . To the best of our knowledge, there is no other efficient algorithm 
to accomplish the task. We also show that our algorithm has lower complexity than solving linear 
equations. 
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The rest of the paper is organized as follows. Section |TT] reviews the general interpolation over free 
modules of polynomial rings, and then introduces Gabidulin codes, KK codes and MV codes, as well 
as their respective decoding algorithms. In Section JIIJ we propose our general interpolation algorithm 
over a free module of a linearized polynomial ring, and analyze its computational complexity. We apply 
our general interpolation algorithm to decode Gabidulin codes as well as KK codes and MV codes in 
Sections ITVl IV1 and IVTl respectively. Concluding remarks are provided in Section IVIII 

II. Preliminaries 

A. General Polynomial Interpolation over Polynomials Ring 

Motivated by the Kotter interpolation, Wang et al. @ consider a general interpolation problem. Let 
F[x] be the ring of all the polynomials over some finite field F. A free F[x] -module V is an F[x] -module 
with a basis. Suppose V is also a vector space over F with a basis M, then we can define a set of C 
linear functionals Dj's from V to F, with corresponding kernels iiQ's, where i = 1, 2, . . . , C. If there is 
a total ordering on M, V admits an ordering. That is, for a subset of V we can find an element with the 
smallest order, and the element is a minimum in this subset. The general interpolation algorithm in ||5) 
finds a minimum in K\ n K 2 fl • • • n Kq- 

B. Linearized Polynomial Ring 

Suppose GF{q m ) is an extension field of GF(g), where q is a prime power and m is a positive integer. 
A polynomial of the form 

n 

l(x) = J2 a i xqi (!) 

with coefficients dj G GF(q m ) is called a linearized polynomial over GF(q m ). We assume q is fixed, 
and denote x q% as in this paper. For a linearized polynomial l{x) = Y17=o a i x over GF(g m ), its 
g-degree, denoted as deg q (l(x)), is given by max{i}. 

Linearized polynomials are so named because for a linearized polynomial l(x) over GF(q m ), j3\ and 
/3 2 in an extension field K of GF(q m ), and Ai,A 2 G GF(q), we have Z(Aift + A 2 /3 2 ) = Xil(fii) + 
A 2 Z(/32). In other words, l(x) can be treated as a linear mapping from /3 G K to l((3) G K with respect 
to GF(q) lUol. Given two linearized polynomials Zi(x) and Z 2 (x) over GF(g m ), their GF(g m )-linear 
combination a\l\{x) + a 2 Z 2 (x) with «i, a 2 G GF(g m ), is also a linearized polynomial over GF{q m ). We 

def 

define the multiplication between h{x) and Z 2 (x) as Zi(x) <g> h{x) = h(h{x)), and l(x) = h(x) (8 Z 2 (a;) 
is also a linearized polynomial over GF(g m ). Note that generally l\(x) ® Z 2 (x) does not necessarily 
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equal fo(x) (g> h(x). Thus the set of linearized polynomials over GF(q m ) with polynomial addition and 
the multiplication <g> forms a noncommutative ring, denoted by L[x\. Note that there is no left or right 
divisor of zero in L[x] ifTTl . 

C. Gabidulin Codes and Loidreau 's Reconstruction Algorithm 

The rank of a vector x G GF(q m ) n is the maximal number of coordinates that are linearly independent 
over GF{q), denoted as r(x; q). The rank distance between two vectors x, y € GF(q m ) n is defined to be 

4(x,y) = r(x - y;q). (2) 

The minimum rank distance of a code C, denoted as d r (C), is simply the minimum rank distance over 
all possible pairs of distinct codewords, that is, d r (C) = min <i r (xj, Xj). 

The maximum cardinality of a rank metric code in GF(q m ) n with minimum rank distance d is 
mm{q m ( n ~ d+1 \ q n ( m - d + 1 )} J6j 5 |fT8l . fl9l . We refer to codes with maximum cardinality as maximum 
rank distance (MRD) codes. A family of linear MRD codes was proposed by Gabidulin |6], and is often 
referred to as Gabidulin codes. An (re, k) Gabidulin code C-ji over GF(q m ) (n < m) is defined by a 
generator matrix G of the form 

^ 90 9i ■■■ 9n-l ^ 



[1] [1] [1] 

9o 9i ■■■ 9n-l 



[fc-1] [fc-1] [fc-1] 

\9o 9[ ■■■ 9n-l ) 



(3) 



where go , g\ , . . . , i are linearly independent over GF (q) . We introduce the vector g = (go , 9i , • • • , 9n- 1 ) 
for future reference. For a message vector u = (uq, u\, . . . , Ufc_i) and its corresponding message poly- 
nomial f(x) = Yli=o u i x ^> th e codeword to be transmitted is x = (f(go), f(gi), ■ ■ ■ , f(9n-i))- Suppose 
an additive error e = (eo, e±, . . . , e„_i) occurs, and the received vector is y = x+e = (yo, yi, ■ ■ ■ , y n -i), 
where = Xi + ej for i = 0, 1, . . . , n — 1. Given y, a bounded distance decoder with decoding radius 
t < (n - k)/2 tries to find x' € Cn and e' € GF(q m ) n such that y = x' + e' with d r (y,x') < t. If such 
x' and e' exist, the received vector y is said to be decodable 0. 

Gabidulin codes can be defined using evaluation of linearized polynomials, analogous to RS codes, 
which are defined using evaluation of polynomials. Hence Loidreau devised a method to decode Gabidulin 
codes through reconstruction of linearized polynomials (cf. lfT3l Table 1]), where a pair of linearized 
polynomials, V(y) and N(x) are constructed such that V(yi) = N(gi) for i = 0, 1, . . . , n — 1, with 
deg q (V(y)) < t and deg q (N(x)) < k + 1 - 1. It is shown (131 that if t < (n - k)/2, one gets a solution 
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of decoding Gabidulin codes from any solution of the reconstruction problem. Loidreau's algorithm 11131 
constructs two sequences of polynomials (Vo(y),No(x)) and (Vi(y),Ni(x)), and updates them iteratively 
by discrepancy-based update rules, so that each sequence satisfies the objective equation for the first i 
points after the ith iteration. To implement the degree constraints on the linearized polynomials, Loidreau's 
algorithm starts with initial polynomials of designated g-degrees, and then aims to increase the g-degrees 
of each sequence of polynomials strictly once every two iterations. The algorithm outputs Ni(x) with 
g-degree no more than k + [(n — k)/2\ — 1 and V\(y) of g-degree no more than [(n — k)/2\. 

D. KK Codes and Their Decoding Algorithm 

KK codes [TJ are a type of subspace codes for random linear network coding, where subspaces are 
transmitted and received at both ends. Suppose W is a vector space over GF(g), and V(W) is the set of 
all subspaces of W. For U, V G V(W), the subspace distance d s [7] between V and U is defined as 

d s (V,U) = dim(V + U) - dim(F n U) , (4) 

where dim(yl) denotes the dimension of a subspace A G V(W), V D U is the intersection space of V 
and U, and V + U is the smallest subspace that contains both V and U. 

Suppose an /-dimensional subspace V G V(W) is a codeword of a KK code. The basis of V is 
obtained via evaluation of linearized polynomials. First we select I (I < m) elements ao, a>i, . . . , a\-\ G 
GF(g m ) that are linearly independent over GF(q). Theses I elements span an Z-dimensional vector space 
(A) C GF(q m ), where A = { ai : i = 0, 1, . . . , I - 1}. We then construct W by W = (A)® GF(q m ) = 
{(a,/3) : a G (A),f3 G GF(q m )}. Given a message vector u = (uo,u\, . . . ,Uk-i) over GF(q m ), the 
message polynomial is defined to be u(x) = Yli=o UiX ^- Finally, the subspace spanned by {(aj,/3j) : 
Pi = u{oLi), i = 0, 1, — 1} is an /-dimensional subspace of W, as all the pairs (ctj, Pi) are linearly 
independent Q. 

Suppose V is transmitted over the operator channel [7 1, and an (I — p+t)-dimensional subspace U of W 
is received, with dim(Z7 n V) = I — p and d s (U,V) = p + t. It is proved that the error is decodable by the 
list-1 decoding algorithm if p+t < l—k+1. Let I— p+t = r, and {(xq, yo), {xi,yi), • • • , (a; r _i,y r _i)} 
be a basis for U. The decoding algorithm in |7 ] consists of an interpolation step and a factorization step. 
First the interpolation procedure finds a nonzero bivariate polynomial Q(x,y) = Q x {x) + Q y {y) such 
that 

Q(xi,yi) = for i = 0, 1,. . . ,r - 1, (5) 
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where Q x {x) and Q y (y) are linearized polynomials of g-degrees at most r — 1 and r — k respectively. Then 
a message polynomial u(x) is obtained in the factorization step by right division [7] if Q(x,u(x)) = 0. 
Decodability is guaranteed if we select r = \(r + k)/2] Q. 

The interpolation procedure of the decoding algorithm in Q, called a Sudan-style list- 1 decoding 
algorithm, adopts some discrepancy based update rules. During the i-th iteration, the algorithm generates 
an x-minimal bivariate polynomial and a y-minimal bivariate polynomial, /i* \x,y) and f^\x,y), that 
interpolate through the first i points for i = 1,2, ... , r, where r is the total number of points to be 
interpolated. Finally, the minimum one between /q (x,y) and f[ r \x,y), defined under an order of 
-< Q, is the decoding output. 

E. MV Codes and Their List Decoding Algorithm 

MV codes are similar to but different from KK codes Q. To enable list decoding, different code 
constructions are proposed for different code dimensions in Ifl4l |fT51 . 

To construct an /-dimensional MV code over GF(q ml ), I has to be a positive integer that divides q — 1. 
Then the equation x l — 1 = has I distinct roots e± = l,e 2 , . . . ,ei over GF(q). Choose a primitive element 
7 over GF(q ml ) with 7, 7M, . . . ^I™' -1 ! being a normal basis for GF(q ml ). Then construct elements «j 
over GF(<2 mi ) by o< = 7 + e^H + e^I 2 ™] + • • • + ej-^M'-i)] for i = l,2,...,l. It is proved (BJ 
that the set {a^ : i = 1, 2, . . . , l,j = 0, 1, . . . , m — 1} is a basis of GF(q ml ) over GF(q). 

For a message vector u = (uq, u\, Uk-i) over GF(g), the message polynomial is u(x) = Yli=o u i x ^- 
Let u® l (x) denote the composition of u(x) with itself by i times for any nonnegative integer i, while 
u®°(x) = x. Then the codeword V corresponding to the message u is spanned by a set of vectors Vi 
for i = 1,2, ... ,1, where v\ = (ai,«(ai),u® 2 (ai), . . . ,tt® L (ai)), = (a i; . . . , U ^J^ ), and 
L is the desired list size. Note that ^-Spl G GF(g m ) for any j > and 2 = 2, 3, . . . , I EJ. Then 
V is an /-dimensional subspace of the (Lm + I) -dimensional ambient space W = (01,02, • • • ,&i) © 
GF(q m ) © • • • © GF(q m ). Suppose an error of dimension t occurs, and an (I + t)-dimensional subspace 

N v ' 

L times 

U of W is received. The decoder first finds subspaces Ui such that U{ = {(x,yi,y2, ■ ■ ■ ,yi) '■ x € 
(at)} for i = 1,2,..., I. Then, a basis {(xij, y^ij, yi i2 ,j, ■ ■ ■ , yi,L,j) ■ j = l,2,...,ri} of U\ is 
found, where r\ is the dimension of U\. If Z = 1, we ignore the first step and simply find a ba- 
sis for the (t + 1) -dimensional received subspace U\. For i = 2,3,...,/, the decoder obtains U[ = 
{(x,aiyi,aiy 2 , ■ ■ ■ ,aiy L ) : (x, j/i, y 2 , • • • , G and finds a basis {(iCjj, y ijltj , y ij2 ,j, ■ ■ ■ , Vi,Lj) ■ 
j = 1,2, ...,rj} of U-, where rj is the dimension of Ui. Finally, the decoder constructs a nonzero 
multivariate polynomial Q(x, yi,y 2 ,---, Vl) = Qo(x) + Qi(yi) + Q 2 {y 2 ) H h Ql{v£), where Q s is 
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a linearized polynomials over GF(q ml ) of (/-degree at most ml — s(k — 1) — 1 for s = 0, 1, . . . , L, such 
that for % = 1, 2, . . . , I, j = 1, 2, . . . , n, and h = 0, 1, . . . , m — 1, 

//u.,) (6) 

Using the LRR algorithm in lfl4l . the decoder finds all possible polynomials u(x)'s such that 

Q(x, u{x),u m {x), u® L {x)) = 0. (7) 

It is proved ifHl that © has a nonzero solution if 

t <IL-L{L + 1)— -, (8) 
2m 

and there are at most L solutions to |7]), among which the transmitted message polynomial u(x) is 
guaranteed to be included. 

III. General Interpolation by Linearized Polynomials 

In this section, we investigate the general interpolation problem by linearized polynomials. We first 
present the general interpolation problem, then propose our general interpolation algorithm, which follows 
a strategy similar to that in J5]. 

A. General Interpolation over Free L[x]-Modules 

Suppose L[x] is the ring of linearized polynomials over GF(q m ), and V is a free L[x]-module with a 
basis B = {6o, b\, . . . , &£,}. We denote the multiplication between an element in L[x] and an element in 
the module by o, and any element Q E V can be represented by 

L L 
j=0 j=0 i>0 

where lj(x) G L[x] and a^j G GF((/ m ). Thus V is also a vector space over GF(q m ) with a basis 

M = {x [i] obj,i > Q,j = Q,1,...,L}. (10) 

Suppose there exists a total ordering < on M, and we can write M = {4>j}j>o such that (pi < <pj when 
i < j. Then Q eV can be represented by 

J 

Q = '52 a j ( t>j' (H) 

where ^ G M and aj 7^ 0. J is called the onier of Q, denoted as order(Q), and 4>j is the leading 
monomial of Q> denoted as LM(Q). We write Q < D Q' if order(Q) < order(Q'), and Q = a Q' if 
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order((5) = order(Q'). An element Q is a minimum in a subset of V if its order is the lowest among all 
the elements in the subset. Further, we define lnd y (l(x) o bj) = j, and lnd y (Q) = Ind 3/ (LM(Q)). Then 
we introduce a partition of V as V = [J ■ Sj, where Sj = {Q € V : lnd y (Q) = j}. 

For the vector space V over GF(g m ), we consider a set of C linear functionals Di from V to GF(g m ): 
L>i, • • • , Dc- Suppose Ki is the kernel of Di and Ki = K\V\ K2 fl • • • n ETj is an L[x]-submodule, 
then the general interpolation problem is to find a minimum Q* € Kc, that is, to find an element Q* € V 
such that it lies in the kernels of all the given linear functionals. Furthermore, we can show the uniqueness 
of Q* as in Q. 

Lemma 1. The minimum in Kc is unique up to a scalar. 

Proof: Suppose both Q* and Q' have the minimum order in Kc, then there exists a nontrivial 
linear combination aQ* + f3Q', where a, (3 € GF(q m ), such that aQ* + (3Q' < Q* = Q Q' . Since 
aQ* + PQ' e Kc, this contradicts the minimality of Q* and Q' . ■ 
Define T,- L j = K^ n 5 1 ,-, and Oj ,■ = min 5, then the general interpolation problem is equivalent to 
finding gij for i = 1, . . . , C. The key idea is to iteratively construct gi+ij from gij by a discrepancy 
based update, starting from some initial values. We propose an algorithm to solve this general interpolation 
algorithm, given in Algorithm Q] In Algorithm [T] there are three cases, and in each case a different update 
is used to obtain gi+ij based on g^j. 

1) If 9i,j S K i+1 , then g i+1J = g i;j . 

2) For <7ij's not in Kj+i, we find one of them with the lowest order, denoted as gij", and check 
whether g itj = Q g itj *. If g itj ± gij,, then g i+1J = D i+1 (gij*)gij - D i+1 (gij)gij,. We call 
this type of update a cross-term update. Note in this case, the order of g^j is preserved, that is, 

9i+lJ = o 9iJ- 

3) For g i+ ij-, we construct g i+ ij- by g i+ ij* = D i+1 (gij*)(x [1] ojy.) - D i+1 (x^ o gi j*) gi j*. We 
call this type of update an order-increase update. In this case, gi+ij* takes a higher order than 
gij*, that is, g^j. < D gi+ij*. 

Lemma 2. In each of the three cases, gi+ij is a minimum in Ti + \j. 

The following proof follows the same approach in the corresponding proof of minimality in EUl 
and 0. 

Proof: We deal with the three cases separately: 
1) We choose g%+ij = 9ij if 9ij £ Since gij is a minimum in Tij and Tij 5 Ti + \j, gij is 
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Algorithm 1 General Interpolation by Linearized Polynomials 
for j = to L do 

9o,j «- &j 
end for 

for i = to C - 1 do 
for j = to L do 

Aj+ij <- D i+ i(gi tj ) 
end for 

J <- {j : A i+1J ± 0} 
if J 7^ then 

j* <- argmin{5jj} 

for j £ J do 
if j ^ j* then 

91+1,3 <~ &i+l,j*9i,j ~ Ai+l,j9i,j* 

else if j = j* then 

9i+i,j <- Ai+i,j(xW o - D i+1 (xW o 
end if 
end for 
end if 
end for 

Q* <~ min g c ,j 



also a minimum in the smaller set Tj+ij. 

2) If <o we construct g i+1>j = D i+1 {g itj *)g i: j - D i+1 (g itj )g i: j*. One can verify that 
D i+1 (g i+1J ) = 0, and thus g i+1J G K i+1 . Since lndy(g i+hj ) = Indj, (&,.,■), g i+hj is also in Sj, 
thus g i+1J G T i+1J . Furthermore, D k (g i+lJ ) = D i+1 (g id ,)D k (g id ) - A+i(&,j)A;(Si,j*) = for 
any k < i, since gi,j,g>i,j* G Hence G Tjj. Since g i+1 j = Q g itj and g itj is a minimum 
in Tij, gi+ij is also a minimum in Tjj, hence a minimum in the smaller set Ti+ij. 

3) In this case, = D i+1 (g id *)(x [l] og id *)-D i+1 (x^og id ,)g id ,. First note that D i+1 (g i+1:j *) = 
0, and hence <?j+ij» G iiQ+i. For any k < i, when we apply D k to gi+ij*, we also get zero 
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because both gij and ccM o g^j* lie in Ki, as Ki is a submodule of L[x}. Thus gi+ij* G i^i+i- 
Also, Indy^i+ij*) = Ind^xM o gij») = j* by our definition Ind y (/(x) o bj) = j. Thus we have 
9i+i,j* G Ti + ij*. Next we show that gi+ij* is a minimum in Tj+ij* by contradiction. Suppose there 
exists fi+ij* G T i+ ij« such that /t+ij» < o 9i+i,j*- Note that order((/j_|_ij*) — order(x 1 ° 9i,j*)- 
Since Tjj* D Tj+ij., fi+ij* also lies in Tjj*. Hence order(/j + ij«) > order (g%,j*), as gij* is a 
minimum in Tij, which results in order(gjj«) < order(/j+ij.) < order(xM o gij»). Since both 
g-ij* and xM o g^j* lie in the set Sj* by definition, there does not exist fi+ij* G such that 
orderly) < order(/j + i j») < order(xM ogj j*). Hence the only possibility is that fi+ij* = 9i,j*- 
But in this case, we could construct h = afi + \j- + f3gij* with a, /3 GGF((/ m ) such that /i < Q <?jj*. 
Note that /i <E Ki but /i ^ K i+ i as G but gjj* ^ ?i+i- The fact that /i G Ki\K^i 

but /i < <7jj» contradicts the minimality of gij* in Ki\K i+ i, as <?j j. has the lowest order among 
all gi/s where g i;j G but g id <£ K i+1 . 

m 

B. Complexity Analysis of Algorithm\J} 

There are a total of C iterations in Algorithm [T] In each iteration, L + 1 linear functionals are first 
carried out to calculate the discrepancies, followed by at most L finite field additions (subtractions) to 
find the minimum candidate and its index among those with nonzero discrepancies. Then to update the 
candidates, we conduct at most 2{L + 1) 2 (D + 1) finite field multiplications, (L + l) 2 (D + 1) finite field 
additions, one multiplication between elements in the ring L[x] and elements in the module V, and one 
computation of the linear functional, where D is the highest (/-degree of the linearized polynomials in 
x among all the iterations. Notice that the (/-degree of each candidate is non-decreasing in an iteration 
based on the update rules. Hence it is safe to choose D to be the highest (/-degree of the polynomial 
in x of the ultimate output. To sum up, the complexity of Algorithm Q] is dominated by 0(CDL 2 ) 
finite field additions, 0(CDL 2 ) field multiplications, 0(CL) linear functional calculations, and 0(C) 
multiplications between elements in the ring L[x] and elements in the module V. Since the complexity of 
the linear functional calculations and the multiplications between elements in the ring and elements in the 
module might vary in different situations, we consider the complexity of each realization of Algorithm Q] 
on a case-by-case basis. 
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IV. Decoding of Gabidulin Codes 

A. Decoding of Gabidulin Codes 

We consider an (n, k) Gabidulin code over GF(q m ) (n < m) as denned in Section Hl-CI and the ring 
of linearized polynomials L[x] over GF(q m ) discussed in Section ITl-Bi Based on Loidreau's polynomial 
reconstruction approach lfl"3l . we generalize the decoding problem of Gabidulin codes from an interpola- 
tion point of view. Suppose we have a set of points (ajj, yi) with yi = f(xi) + ej for i = 0, 1, . . . , n — 1, 
where x^'s are linearly independent and r(e;q) < t. Try to construct a nonzero bivariate polynomial 
Q(x,y) = Qo(x) + Qi(y) with Qi(x) and Q 2 {y) being linearized polynomials over GF(q m ), such that 
max{deg 9 ((5i(x)), k — 1 + deg q (Qi(y))} is as small as possible and 

Q(xi,yi) = Qi(xi) + Q 2 (yi) = for i = 0, 1,. . . ,n- 1. (12) 

We will show that a solution of (TT2l gives a solution to the decoding problem of Gabidulin codes under 
some conditions. Then we formalize (TT2l to a general interpolation problem over free L[x) -modules, and 
solve it by Algorithm Q] 

Suppose deg q (V) = r, and deg q (N) = r + k — 1. To have a nonzero solution of (fTZb . the number of 
unknown coefficients should be greater than the number of equations, that is, 

2r>n-k-l. (13) 

Next suppose Q(x, y) = N(x) — V(y) is a nonzero solution of (fl"2l. Substituting y by the message 
polynomial f(x), we get = N(x) - V(f{x)). When Q(xJ(x)) = 0, i.e., iV(x) - V(f(x)) 

is the zero polynomial, f(x) satisfies A^(a;) = V(x) <8> /(x) and thus can be obtained by right division 
over the linearized polynomial ring ||7]. 

It remains to identify the condition under which Q(x,f(x)) is identically zero. Since Q(x,y) = 
N(x)-V(y) is a nonzero solution of (Q2), Q(xi,yi) = N(xi)-V(yi) = 0,i.e., N(xi)-V(f(xi)) = V(ei) 
with the rank of (V(eo), ^(ei), . . . , V{e n -\)) no more than t. Then there exists a nonzero linearized 
polynomial W of g-degree at most t such that W(V(ei)) = W(N(xi) — V(f(xi))) = for i = 
0, 1, ... , n— 1. Then we have a linearized polynomial W (N (x) — V (f (x))) of g-degree at most t+r+k— 1 
with n linearly independent roots x% for i = 0, 1, . . . , n — 1. Thus when t + r + /c — l<n, we have 
W^A^a;) — V(f(x))) = 0. Since there is no left or right divisor or zero in the linearized polynomial 
ring [17] and W is nonzero, we have N(x) — V(f(x)) = 0, hence f(x) can be obtained by right division 
over the linearized polynomial ring. The condition t + r + k — 1 < n will be satisfied by forcing 

t < t, (14) 
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and restricting 

2t <n-k + l. (15) 

Combining ( fl3l and ( fT5T ), we select r = |_(n — k)/2\, and have 

* < [(n-k)/2\. (16) 

Hence if (PT6l) is satisfied, a solution of (fl2l) gives a solution to the decoding problem of Gabidulin 
codes. Next we formalize the interpolation problem in (fl2T i to a general interpolation problem over free 
L[x]-modules. 

We select B = {bo,bi} = {x,y} as a basis, and construct a free L[x]-module V = {Q{x,y)} from 

Q(x,y) = l (x) o b + l±(x) o bi, (17) 
where lo(x),h(x) G L[x], and the multiplication o is defined as 

rlpf 

l(x) o bj = l(bj), for j = 0, 1. (18) 

Hence Q(x,y) = lo(x) + h(y), and we call such Q(x,y) G V a bivariate linearized polynomial. 
Following © and (fT0l >. V is also a vector space over GF(q m ) with a vector space basis M = {a;W ofy, z > 
0, j = 0, 1}. Then we define a total ordering on M as follows. We write < b^ +1 ^ for j € {0, 1} and 
i > 0, and write x[ J+fc_1 ] < j/M < x[ J+fe l for i > 0. Once the total ordering on M is determined, the 
leading monomial and the order of any Q € V can be defined as described in Section ITlI-Ai Consequently, 
given a subset of V, a minimum element in V can be found. 

Finally, we define a set of linear functionals D{ from V to GF(q m ) to be Di(Q) = Q(xi,yi) = 
lo{xi)+li{yi) for % = 0, 1, . . . , n— 1, where (xi,yi)'s are the points to be interpolated. If Di(Q(x, y)) = 0, 
Q(x,y) is said to be in the kernel ETj of Di. The kernels are L[x]-submodules by the following lemma. 

Lemma 3. Ki is an L[x]-submodule. 

Proof: Since Ki is a subgroup of V, it is easy to show that Ki is an Abelian group under polynomial 
addition, and the associative and distributive laws hold for the multiplication between elements in L [x] and 
elements in Ki. Now we consider an arbitrary element l(x) € L[x] and an element Q(x, y) € Ki. Suppose 

K x ) = Ej=o a i x[jl with a i e GF(q m ), and Q{x,y) = l (x) + h{y) with l (x),h{x) £ L[x\. Then 
l(x)oQ(x,y) = (E]=o a ^ [j] ) Mx)+h(y)) = E]= aj(k(x) [j] +h(y) [j] ) = ZU^(h(x)+h(y)p. 
Given Di(Q(x,y)) = lo(xi) + h(yj) = 0, we have D, t (l(x) o Q(x, y)) = YTj=o a i{h{xi) + li{yi)) [3] = 0. 
Hence Ki is a submodule of L[x]. ■ 
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Hence Ki is also an L[x]-submodule. Consequently, the interpolation problem described by (fT2l i is to 
find a minimum Q € V such that Q is a minimum in K n -\. This is a general interpolation problem 
over free L[x] -modules as described in Section Hll-A[ and Algorithm Q] solves it by finding a minimum 
nonzero solution. 

To use Algorithm Q] first we set 50,0 = x, and 50,1 = V m the initialization step. In the following 
iterations, multiplication between an element in L[x] and an element in V in the cross-term and order- 
increase updates follow (TT8T ). In particular, g%+i j* = Di + i(gij*)(x^ o gij*) — Di + \{x^ gi,j*)gi,j*- 
Since Z)j + i (#«,.;'*) ^ 0, we can also omit it from the right hand side, and instead use gi+ij* = gfj* — 
(Di + i(gij*)) q ~ l gij* , as scaling by a nonzero scalar does not affect the order of an element in V. 

Now we consider the complexity of Algorithm [T] when used to decode Gabidulin codes. Adopting 
the same set of parameters in the complexity analysis in Section IIII-Bi we have L = 1, C = n, and 
D = L^j^J based on © and the following argument. Second, each linear functional in this case carries 
out evaluations of the bivariate linearized polynomial by the given points, with a total of O(DL) finite 
field multiplications and O(DL) finite field additions. Finally, the multiplication between xM an( j ^ . 
is accomplished by raising the coefficients of gij to the q-th power, which is simply a cyclic shift if a 
normal basis is chosen ll2Till22l . In summary, when used to decode KK codes, Algorithm [j] takes a total 
of 0(n(n+k)) finite field multiplications in GF(q m ). On the other hand, the complexity analysis in ll23l 
gives an overall complexity of |n 2 — |fc 2 + Hence both algorithms are of quadratic complexity. 

B. Comparison to Loidreau 's Reconstruction Algorithm 

Although our cross-term and order-increase update rules are similar to that of the alternate increasing 
degree step in Loidreau's algorithm, we observe that Algorithm Q] differs from Loidreau's algorithm in 
two aspects, stated as follow. 

First, Loidreau's algorithm uses another algorithm ll24l in the precomputation step before initializing 
the main algorithm, for the purpose of reduced complexity, whereas our decoding algorithm carries out all 
the iterations solely from the interpolation approach. But as shown in the previous section, both Loidreau's 
algorithm and Algorithm [T] have quadratic complexities. Further, we will show the equivalence of the 
polynomials derived after the initialization step of Loidreau's algorithm and the ones obtained after the 
first k iterations of Algorithm \T\ The initialization step of Loidreau's algorithm actually introduces two 
bivariate polynomials Qq = Nq(x) — Vo(y) and Qi = Ni(x) — V\{y). Given our previous notations, 
Algorithm Q] produces two bivariate polynomials g^ Q and g^ i after the first k iterations. The relation 
between these four polynomials are stated in Lemma |4] 
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Lemma 4. The initial bivariate polynomials of Loidreau's algorithm and the bivariate polynomials 
derived after the first k iterations of Algorithm\l\are of the same order correspondingly, i.e., Qq = q gk,o 
and Qi = Q # fe>1 . 

Proof: In the initialization step of Algorithm [T] go,o = x is of lower order than 50,1 = y, and 
^1(50,0) = a^o 7^ as Xj's are linearly independent, so (/o,o = % updates by the order-increase rule, while 
5o,i = y updates according to its discrepancy value. Then gip is actually a linearized polynomial in x 
of (/-degree 1, and gi t i is a bivariate polynomial with a leading monomial cy, where c € GF(q m ) is a 
constant. 

In the second iteration, again <?i o < 9i,i based on our total ordering on M, and 1)2(91,0) 7^ as 
XiS are linearly independent, i.e., there does not exist a linearized polynomial of (/-degree 1 that has two 
linearly independent roots. Hence gi$ takes the order-increase rule and gx,l adopts others accordingly. 
Similar situation occurs in all the first k iterations, given the total ordering we defined on M and the 
fact that Di + i(gifi) ^ for any i < k. 

Finally, a ^,0 in x of (/-degree k is derived, which actually only interpolates over the first k Xi's. 
Note that Nq(x) is obtained in the same way by Nq(x) = Int(xQ, . . . , in Loidreau's algorithm. 

Given that Vo(y) = 0, we have Qq = Nq(x). Hence g^fi = Qo- On the other hand, g^i is a bivariate 
polynomial with a leading monomial c'y, where c' G GF(q m ) is also a constant. Since Ni(x) is a linear 
combination of linearized polynomials of (/-degree k — 1, it is a linearized polynomial in x of (/-degree 
at most k — 1, then the leading monomial of Qi is y. As a result, g^\ = Q Q\. ■ 

Note that the (/-degree of Nq(x) is exactly k, as it actually interpolates over k linearly independent 
points xo, xi, . . . , Xk-i- Ni(x) is a linear combination of polynomials of (/-degree k — 1, but its (/-degree 
might be lower than k — 1, as the most significant coefficients may cancel each other. Thus the claim 
in |[T3l that after the final iteration deg g (Vi(y)) = [(n — k)/2\ is inaccurate. 

The second difference between Loidreau's and our decoding algorithms lies in the update of the 
interpolation steps when some of the discrepancies are zero. It should be pointed out that in the alter- 
nate increasing degree step of Loidreau's algorithm, so in operations (c) and (d) should be s q ^ in 
( |[T3l Table 1]). After the correction of this typo, the key difference between Loidreau's algorithm and 
Algorithm Q] is that the latter accounts for zero discrepancies, while the former only covers it partially. 
To be specific, Loidreau's algorithm |[T3l Table 1] malfunctions when s± = but sq / 0, as shown in 
Lemma [5] 

Lemma 5. If si = but sq ^ at the beginning of any iteration, all four linearized polynomials of 
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the Vo,Nq,Vi and N\ in Loidreau's algorithm will be the zero polynomial after a certain number of 
iterations. 

The proof can be conducted simply by tedious calculations, hence we will not present it here. Instead, an 
example is given to illustrate Lemma [5j where s\ = but sq ^ happens during an intermediate iteration. 
To fix the problem in Lemma [5j one way is not to update the candidates when the zero discrepancy is 
involved. But such an operation breaks the rule of updating the g-degrees of the candidates alternately, 
which is designed to ensure strict degree constraints on the output of the algorithm. Further notice that sq 
and si are involved in different types of update rules for the two pairs of candidate polynomials, hence 
for the case of si ^ but sq = 0, the algorithm in |[T3l Table 1] works properly. 

Example 1. We construct a (6,2) Gabidulin code over GF(2 6 ) with g = (a 31 , a 48 , a 32 , a 16 , 1, a 47 ), 
where a is a primitive element of GF(2 e ) and is a root of x 6 + x + 1 = 0. Given the message vector 
u = (1,0), the message polynomial is f{x) = x, with a codeword x = (f(go), f(di), ■ ■ ■ , fidn-i)) = 
g. Suppose the error vector is e = (0,a 48 ,a , 0, 0, 0), and the received vector is y = x + e = 
(a 31 , 0, a 19 , a 16 , 1, a 47 ). The decoding procedures by Loidreau's algorithm and Algorithm [7J are pre- 
sented in Table [7J Based on Lemma [7] we start from the initial polynomials of Loidreau 's algorithm and 
the polynomials after the first k iterations by Algorithm [7J Note that g$ in the final iteration is not listed, 
as it is of higher order than g\. Since r(e; q) = 2 < t = (n — k)/2, y is decodable. As shown in Tabled 
however, Loidreau 's algorithm fails. On the other hand, our algorithm produces a bivariate polynomial 
9n,i = a 4 £ 4 + x 2 + a 29 x + a 4 y 4 + y 2 + a 29 y, from which the correct decoding result f(x) = x is 
obtained. 

V. Decoding of KK Codes 

For a KK code over GF(q m ) as described in Section III-Dl the decoding algorithm in Q finds a 
minimum solution to (f5j) based on an interpolation procedure. In this section, we will show that this 
list- 1 decoding algorithm is a special case of our general interpolation algorithm over free L[x] -modules, 
where L[x] is the ring of linearized polynomials over GF(g m ). 

Lemma 6. When L = 1, Algorithm [7J reduces to the Sudan-style list-1 decoding algorithm in STj. 

Proof: We assume that the condition of decodability |7] is satisfied so that an interpolation approach 
works to gives a solution of Q(x,y). Given the linearized polynomial ring L[x] over GF(q m ), we set 
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TABLE I 

ExampleQ] Use Loidreau's algorithm and AlgorithmQ]to decode Gabidulin codes 



i 


Loidreau's algorithm 


Algorithm Q] 


2 


No = x 4 + a 5 x 2 + a 31 x, V = 

\T „48„,2 | „33„ \r 

iVi = a x + a x, Vi — y 


50 = x 4 + a 5 x 2 + a 31 x 
gi = a 16 x 2 + ax + a 31 y 


3 


s = a 7 , si = 

No = a 33 x 4 + a 3 x 2 ,V = y 2 

JVi = a x -\- a x, V\ ~ a y 


A =a 7 ,Ai =0 

go = x 8 + a 39 x 4 + a 34 x 2 + « 38 x 

gi = a 2: + ax + a y 


4 


17 47 

so = a , si — a 

ivo = a; x -\- ol x -\- ol x, vo = ot y + a y 
JVi = a 17 x 4 + a 37 x 2 + a 57 x, Vi = a 47 y 2 + a 24 y 


A = a 50 , Ai = a 8 

^8^.8 _I_ „, 4 7^, 4 i „, 4 6^.2 i „,45^ , -,18„, 

yo = x -(- a x + a x -\- a x -\- ol y 
9l = a 32 x 4 + a 52 x 2 + a 9 x + a 6 V + a 39 y 


5 


31 

so = cx , si = a 

JV = a 34 x 8 + a 37 x 4 + a 10 x 2 + a 5S x, V = a 31 y 4 + a 25 y 
Ni = 0, Vi = 


A =a 18 ,Ai = a 16 

ff0 = Q 24 x 8 + a 22 x 4 + a 47 x 2 + a 58 x + a 17 y 2 + a 49 y 
5 i = ax 8 + a 4 x 4 + a 40 x 2 + a 25 x + a 61 y 4 + a 55 y 


6 


s =a 16 ,si = 

iVi = 0, Vi = 0, N = 0, Vb = 


A = a 6 ,Ai =q 46 

9l = a 4 x 4 + x 2 + a 29 x + a 4 y 4 + y 2 + a 29 y 



L = 1, choose a set -B = {60,61} = as a basis, and construct the same free L[x]-module 

V = {Q(x,y)} with the same ordering as that in Section [TV] Hence Algorithm Q] has exactly the same 
initial values and the same update rules as the Sudan-style list- 1 decoding algorithm in [7 ] (it should be 
pointed out that the pseudocode in Q contains a typo, and no update is going to take place when both 
discrepancies are zero [?]). Hence we only have to show that the final output of the two algorithms are 
the same (of the same order). 

We consider the definition of minimum in Algorithm [T] and the notion of x-minimal and y-minimal 
in Q. According to the definition in Q, f$ (x,y) is x-minimal if it interpolates through the first i 
points and is a minimal polynomial under -<, while its leading term is in x. Comparing this definition 
to that in our general interpolation construction, we find that this f(x,y) is a minimum in Tj.o, hence 
ff?\x,y) = 9i,o- Similarly, f±\x,y) being y-minimal means that f{\x,y) = g it \ in Algorithm [Q 
Since KK's decoding algorithm finds x-minimal and y-minimal bivariate linearized polynomials in each 
step, it works the same as Algorithm [T] during intermediate steps. Finally, KK's decoding algorithm 
outputs the one with a smaller (1, k — 1) -weighted degree, which equals to finding the minimum among 
gc,o and gc ; i as performed in Algorithm Q] Hence our general interpolation algorithm reduces to the 
list- 1 decoding algorithm in Q when L = 1. ■ 

The proof of Lemma [6] also indicates that when used to decode KK codes, Algorithm Q] requires finite 
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field multiplications of order 0(n(n + k)) . 

VI. List Decoding of MV Codes 

In lfl4l . the list decoding procedure first constructs a multivariate polynomial Q(x, yi, y-i, ■ ■ ■ , y£) 
that interpolates through a number of given points as indicated by ©. Hence we call this process 
the interpolation step of the list decoding of MV codes. No specific algorithm is mentioned in |[T4l 
on how to get this multivariate polynomial. Of course, a nonzero solution can be obtained by solving 
the corresponding homogeneous systems, but with high computational complexity. Here, we utilize the 
general interpolation over free L[x] -modules to solve this problem efficiently. The complexity of our 
algorithm is compared to that of solving homogeneous equations. 

As in Section |lVl we have to construct a free module for a given ring, and define relative operations 
so that Algorithm [T] can be carried out. We consider an /-dimensional MV codes over GF(q ml ) defined in 
Section III-EI with a message vector length of k and dimension of subspace I. In this case, the linearized 
polynomials ring L[x] is defined over GF(q ml ), and a set B = {60,61, . . . , 6^} = {x,y\, . . . ,yz,} is 
selected to form a free L[x]-module V = {Q(x, y\, . . . , J/i)}. Following a similar definition of the 
multiplication between L[x] and V, the module V is constructed in the same way as in Section JV] Hence 

an element Q{x,y%, . . . ,y L ) G V can be written as Q(x,yi, ...,y L ) = Qo{x) + Qi(yi) H \-Ql(vl), 

called a multivariate linearized polynomial, where Qi(x) € L[x] for % = 0, 1, . . . , L. Following similar 
process as in the previous section, we can claim that V is also a vector space over GF{q ml ) with a vector 
space basis M = {x™ obj, i > 0, j = 0, 1, . . . , L}. Then we define an total ordering on M as follows. We 
write bf < b [ j +1] for j € {0,1,. . . ,L} and i > 0, and write bf < bf, ] if j(k-l) + i = (j + l)(k-l) + i' 
and j < j' for j,j' € {0,1,..., L} and > 0. Then M = {<fij}j>o such that <pi < <pj when 
i < j. Hence we can define the leading monomial and the order of any Q € V in the same way as in 
Section IIII-Al as well as the minimum elements in a subset of V. Finally, a set of linear functionals D{ 
for i = 1, 2, . . . , (t + l)m from V to GF(g m ') are also defined to be evaluations of multivariate linearized 
polynomials by the given points, as indicated in ([6]). Here, the total number of points to be interpolated in 
© is (t+l)m, hence the numbers of linear functionals Di and of the kernels Ki are (t+l)m. Furthermore, 
the kernels Ki are also L[x]-submodules by Lemma [3] In summary, the interpolation problem in © is 
to find a nonzero Q £ V such that Q £ Kr t+ t) m . Hence this is a general interpolation problem over free 
L[x]-modules, thus can be solved by Algorithm \T\ which gives a minimum nonzero solution to d6j, as 
stated in the following lemma. 
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Lemma 7. The general interpolation algorithm solves the interpolation problem of the list decoding 
algorithm for l-dimensional MV codes if the dimension of the error t < IL — L(L + 

Proof: As shown in [14], when t < IL — L(L + 1)^^-, there exist nonzero solutions for the 
interpolation step of the list decoding algorithm fir MV codes. Hence we assume t <IL — L(L + 1)^7, 
then Algorithm Q] solves the interpolation problem by finding a minimum nonzero solution to d6j, when 
we adopt the free modules and related operations as described above. ■ 

For Algorithm [TJ we set 30,0 = x, go,i = Ui for i = 1, 2, . . . , L in the initialization step. The update 
rules in the intermediate iteration steps are the same as in Section [TV] only that we have to use the new 
ordering related definitions in this section to determine a minimum among the L + 1 candidates. 

Finally we discuss the complexity of Algorithm Q] when used to decode /-dimensional MV codes. As 
mentioned above, a nonzero multivariate linearized polynomial Q(x, yx, . . . , y^) can also be obtained by 
solving the homogeneous system determined by ©. The size of the coefficient matrix is (t+l)mx (ml(L+ 
1) - ^-L(L + 1)). Gaussian elimination has a complexity of 0((t + l) 2 m 2 (ml(L + 1) - ^pL(L + 1))). 
Given the fact that ml — L{k — 1) — 1 > (the ^-degree of Ql{ul) has to be nonnegative), this complexity 
is 0{L 2 m 2 {t + l) 2 {k — 1)). On the other hand, for Algorithm [TJ we have C = (t + l)m linear functionals 
in this case and a total of L + 1 elements in the basis of the free module, and the highest g-degree of 
the linearized polynomials in x is at most ml — 1 among all the iterations. Since the linear functional 
operation and the multiplication between elements in the ring and elements in the module are defined in 
the same manner as in KK codes case, the complexity of Algorithm Q] is of 0(L 2 m 2 (t + 1)1). Hence the 
general interpolation approach is more efficient when compared to solving linear equations. 

VII. Conclusion 

In this paper, we investigate the general interpolation problem over free modules of a linearized 
polynomial ring, and propose a general interpolation algorithm. Our general interpolation algorithm 
are used to decode Gabidulin codes and KK codes. Comparisons are made between our algorithm for 
Gabidulin codes and Loidreau's decoding algorithm. Analysis shows that the Sudan-style list- 1 decoding 
algorithm for KK codes is a special case of our general interpolation algorithm. Our general interpolation 
approach also applies to find the multivariate linearized polynomial in the list decoding of MV codes by 
Mahdavifar and Vardy, while currently no efficient algorithm is available to accomplish the task. 
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